(#14093) Remove unsafe attributes from TemplateWrapper

The attribute accessor for the :string attribute in the TemplateWrapper
conflicted with a variable being in scope that is named string. The
variable would take precedence and because of the way the
TemplateWrapper accessed the value of the attribute, the variable's
value would be used as the template.

This changes the TemplateWrapper to completely remove :string as an
attribute and only use local variables. This also removes the :file
attribute in favor of a "private"-style naming of the instance variable.
There are no collisions with @__file__ that would cause problems, but
this should reduce the likelihood of them happening in the first place.

This commit is modified from the original version to exclude changes to
the specs that were not related to issue #14903, due to the scope code
being so different in 2.6.x than 3.x.
(#14093) Restore access to the filename in the template

The change to fix certain variables interfering with template evaluation
also removed the accessor method for file. It appears that this is a
mechanism that had been used by others for identifying the name of the
template being evaluated so that they can trace back from a file on a
node to the module and template that created it. This restores that
functionality.
Merge branch 'zaphod42/2.6.17/14093-string-template-overrides' into security/2.6.17/february_code_orange

* zaphod42/2.6.17/14093-string-template-overrides:
  (#14093) Restore access to the filename in the template
  (#14093) Remove unsafe attributes from TemplateWrapper
(#19151) Reject SSLv2 SSL handshakes and ciphers

Without this patch, SSL connections on older versions of Ruby will
negotiate down to insecure modes of operation, specifically SSLv2.  This
is a problem because SSLv2 needs to be rejected outright to meet
security policies.

This patch addresses the problem by changing the behavior of the
OpenSSL::SSL::SSLContext class.  With this patch applied, all SSLContext
objects will be initialized with a default cipher rule set that always
contains the '!SSLv2' substring.  This has the effect of removing SSLv2
ciphers from the cipher list and prohibiting them from being re-added by
later elements in the cipher spec.

Details regarding how OpenSSL behaves with this cipher string are
available at: http://www.openssl.org/docs/apps/ciphers.html

In order to see which ciphers are enabled for a specific version of the
OpenSSL library, please see the output of the command:

    $ openssl ciphers $CIPHERS

This command will display an ordered list of the ciphers enabled for use
during the SSL handshake.

This change is a monkey patch to MRI Core and will affect all SSL socket
clients and servers.  The options and cipher list may still be
explicitly set by passing an options hash with the :options and :ciphers
keys to the SSLContext#set_params method.
Merge branch 'jjm_fix/2.6.17/reject_sslv2' into security/2.6.17/february_code_orange

* jjm_fix/2.6.17/reject_sslv2:
  (#19151) Reject SSLv2 SSL handshakes and ciphers
(#19391) (CVE-2013-1652) Disallow use_node compiler parameter for remote requests

Without this it is possible to bypass catalog access restrictions by passing
in a node object for a different host. We also validate that facts provided
match the node requested.
(#19392) (CVE-2013-1653) Validate instances passed to indirector

This adds a general validation method to check that only valid instances can
be passed into the indirector. Since access control is based on the URI but
many operations directly use the serialized instance passed in, it was
possible to bypass restrictions by passing in a custom object. Specifically it
was possible to cause the puppet kick indirection to execute arbitrary code by
passing in an instance of the wrong class. This validates that the instance is
of the correct type and that the name matches the key that was used to
authorize the request.
Merge branch 'security/2.6.17/indirector-validation' into security/2.6.17/february_code_orange

* security/2.6.17/indirector-validation:
  (#19392) (CVE-2013-1653) Validate instances passed to indirector
  (#19391) (CVE-2013-1652) Disallow use_node compiler parameter for remote requests

closes #15
(#8858) Refactor tests to use real HTTP objects

This is a backport of commit cd4bee82:

Test SSL setup code, not our stubbing of it.

This rewrites the tests to actually test code - previously, almost every
single object involved was a stub.

There shouldn't be any functional changes, other than tests that might
actually fail at some point, falling out of this.

The results are not the most awesome of tests, but they are markedly
better than before we started.
(#8858) Explicitly set SSL peer verification mode.

In Ruby 1.8 the Net::HTTP library defaults to skipping peer verification when
no mode is explicitly set.  Ruby 1.9, on the other hand, does not: it defaults
to verification of the peer certificate - leading to failure when we depended
on the default value in our HTTP setup.

This changes to explicitly set the verification mode, ensuring we get
consistent results across all Ruby versions.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>

This is modified from the original patch to not check the store in the
case of an HTTPS setup without all certificates.
Merge branch 'jnc/2.6.17/ssl_verify_mode' into security/2.6.17/february_code_orange

* jnc/2.6.17/ssl_verify_mode:
  (#8858) Explicitly set SSL peer verification mode.
  (#8858) Refactor tests to use real HTTP objects
(#19391) Backport Request#remote? method

Commit ccf2e4c relies on the Request#remote? method, which only exists
in 2.7, added in commit fe1f4a20.

This commit backports the change and specs.
(#19531) (CVE-2013-2275) Only allow report save from the node matching the certname

Without this patch applied any authenticated client is able to save a
report for any node by default.  This is a problem because the
compliance feature of Puppet Enterprise expects reports to be submitted
only from the node the report is associated with.

This patch addresses the problem by restricting the access control rules
in a similar manner to the catalog.  With this patch applied, the
default behavior of the Puppet master will only allow reports to be
saved when the node name matches the cert name.
Merge remote-tracking branch 'puppet-cve-test/jjm/2.6.17/feb_co_2275_reports' into security/2.6.17/february_code_orange

* puppet-cve-test/jjm/2.6.17/feb_co_2275_reports:
  (#19531) (CVE-2013-2275) Only allow report save from the node matching the certname
Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654, 2274, 2275)

(#14093) (CVE-2013-1640) Facts override template scope variables
(#19391) (CVE-2013-1652) Validate improper query parameters
(#19392) (CVE-2013-1653) Puppet kick
(#19151) (CVE-2013-1654) Do not downgrade to SSLv2
(#19393) (CVE-2013-1655) Add acceptance test for safe YAML de-serialization
(#19456) (CVE-2013-2274) All your terminii belog to us!
(#19531) (CVE-2013-2275) Add acceptance test for report save ACL
(#19392) (CVE-2013-1653) Validate indirection model in save handler

In puppet 2.6 we need to validate the model before calling save, since it is
called directly on the instance.
(#19392) (CVE-2013-1653) Fix acceptance test to catch unvalidated model on 2.6

This modifies the acceptance test for model validation to catch the issue
fixed in the previous commit. By making the request key match the exec
resource type and title the resource can be executed remotely.
Always read request body when using Rack

In certain versions of Passenger (all of them), leaving the request body
unread will cause an EPIPE exception inside Passenger, resulting in a
500 response. This is because Passenger makes a blocking write of the
request body to the application (Puppet). If we respond without reading
the body, this write is interrupted, which isn't handled properly by
Passenger. So when processing requests, we make sure to have always read
at least 1 character, which unblocks the write and lets Passenger
continue.

This issue is not present in other HTTP handlers.

https://code.google.com/p/phusion-passenger/issues/detail?id=471

Paired-With: Josh Cooper <josh@puppetlabs.com>
Fix order-dependent test failure in rest_authconfig_spec

This test was assuming the RestAuthConfig singleton hadn't been created.
A previous test does create one, so this test was failing. Now, we make
sure the singleton instance is nil before testing.
Merge remote-tracking branch 'puppet-cve-test/security/2.6.17/february_code_orange' into security/2.6.17/february_code_orange